Python

Theory

Python scripting is a powerful tool used by system administrators and developers to automate tasks and streamline processes on Unix-like systems. However, like any software, python scripts can be vulnerable to various security issues, which, if exploited, can lead to privilege escalation and unauthorized access.

Practice

PythonPath Hijacking

Enumerate

Assume the python script can be executed as root with sudo rights and SETENV.

sudo -l
    (root) SETENV: NOPASSWD: /usr/bin/python3 /opt/scripts/example.py

With SETENV, we can change PYTHONPATH when executing the script, and insert malicious script to the module which is imported in the script.

First, we can check what module is imported in the python script (e.g. /opt/scripts/example.py here).

import random
print(random.randint(1, 8))

Exploit

Python Library Overriding

Enumerate

Assume the python script can be executed as root with sudo rights. If the Python script contains a module that can be modified by current user, we can inject arbitrary code into the module.

sudo -l
    (root): /usr/bin/python3 /opt/scripts/example.py

Find writable python modules

$ find / -name "*.py" -writable 2>/dev/null
/usr/lib/python3.11/random.py

We can check if modules on which we have write access are imported by the script

import random
print(random.randint(1, 8))

Exploit

Python Library Hijacking

Enumerate

Assume the python script can be executed as root with sudo rights. If we can write on the folder containing the script, then python will prioritize the execution of this module instead of the usual path

sudo -l
    (root): /usr/bin/python3 /opt/scripts/example.py

Check what modules are imported by the script

import random
print(random.randint(1, 8))

Check write access

$ touch /opt/scripts/random.py

Exploit

OS Commands in input()

Enumerate

Assume the python script use python2.x and can be executed as root with sudo rights. If it use the input function and we controll its input, then the script is vulnerable to arbitrary code execution. the input() function is equivalent to eval(raw_input).

sudo -l
    (root): /usr/bin/python2.7 /opt/scripts/example.py

Check if we have control over the input of the vulnerable function

compute = input('\nYour expression? => ')

Exploit

OS Commands in Eval() and Exec()

Enumerate

Assume the python script can be executed as root with sudo rights. If it use the eval() or exec() method and we controll its input, then the script is vulnerable to arbitrary code execution.

sudo -l
    (root): /usr/bin/python3 /opt/scripts/example.py

Check if we have control over the input of a vulnerable function

#With eval
eval(text)
eval(f"5 + {num}")
print ("Result =", eval(comp))

#With exec
code = input('What command(s) in python did you learn today?')
exec(code)

Exploit

Format String Exploit

Enumerate

The str.format() string method was introduced in Python 3 was later also added to Python 2.7. It allows multiple substitutions and value formatting. Vulnerability comes when our Python app uses str.format() in the user-controlled string. This vulnerability may lead attackers to get access to sensitive information.

Here is an example of a vulnerable code:

# Let us assume this CONFIG & SECRET holds some sensitive information
CONFIG = {
	"KEY": "ASXFYFGK78989"
}
SECRET = [line.strip() for line in open("/root/.ssh/id_rsa")]

class PeopleInfo:
	def __init__(self, fname, lname):
		self.fname = fname
		self.lname = lname

def get_name_for_avatar(avatar_str, people_obj):
	return avatar_str.format(people_obj = people_obj)


# Driver Code
people = PeopleInfo('GEEKS', 'FORGEEKS')

# case 1: st obtained from user
st = input()
res = get_name_for_avatar(st, people_obj = people)
print(res)

Exploit

PyYaml Code Execution

Enumerate

Assume the python script can be executed as root with sudo rights. If it use the yaml.load() method and we controll its input, then the script is vulnerable to arbitrary code execution.

sudo -l
    (root): /usr/bin/python3 /opt/scripts/example.py

Check if we have control over the input of a vulnerable function

import yaml

filename = "example.yml"
yaml.load()

Exploit

References

https://exploit-notes.hdks.org/exploit/linux/privilege-escalation/python-privilege-escalation/exploit-notes.hdks.org

Linux Privilege Escalation : Python Library HijackingMika's Blog | Sysadmin, Network & Infosec

Command Injection in Python: Examples and PreventionStackHawk, Inc.

Vulnerability in str.format() in Python - GeeksforGeeksGeeksforGeeks